Dual quantum information splitting with degenerate graph states 
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We propose a protocol for secret sharing, called dual quantum information splitting (DQIS), that 
reverses the roles of state and channel in standard quantum information splitting. In this method, 
a secret is shared via teleportation of a fiducial input state over an entangled state that encodes the 
secret in a graph state basis. By performing a test of violation of a Bell inequality on the encoded 
state, the legitimate parties determine if the violation is sufficiently high to permit distilling secret 
bits. Thus, the code space must be maximally and exclusively nonlocal. To this end, we propose two 
ways to obtain code words that are degenerate with respect to a Bell operator. The security of DQIS 
comes from monogamy of nonlocal correlations, which we illustrate by means of a simple single-qubit 
attack model. The nonlocal basis of security of our protocol makes it suitable for security in general 
monogamous theories and in the more stringent, device- independent cryptographic scenario. 



I. INTRODUCTION 

Quantum entanglement enables tasks in communica- 
tion and cryptography not possible in the classical world, 
e.g., quantum teleportation [l|, dense coding and un- 
conditionally secure key distribution Experimental 
breakthroughs have enabledpractical creation and ma- 
nipulation of entanglement [3[ , an achievement duly rec- 
ognized by the 2012 Nobel prizes in physics. Several 
telcportation-based protocols with multi-particle chan- 
nels have been proposed (14l^|. In particular, entangle- 
ment can be used for quantum secret sharing (QSS), the 
quantum version of classical secret sharing [131 ] . QSS in- 
volves a secret dealer splitting information, representing 
the secret quantum state |\&), among a number of agents, 
such that only authorized subsets of them can reconstruct 
the secret. 

A protocol for splitting quantum information, and tele- 
porting it to more than one party over an entangled chan- 
nel, such that a subset of agents sharing the entangle- 
ment, is able to reconstruct the information, was first 
proposed in Ref. [3], further studied by various au- 
thors [lB - fl9j , and also implemented experimentally [20T - 
[22j (the last employing only sequential measurements on 
a single qubit). We will refer to such teleportation-based 
QSS as quantum information splitting (QIS). Both QSS 
and QIS can be used to share both quantum and classical 
secrets. 

An important resource of entanglement arc graph 
states that are useful in quantum error correction 12311 . 
one-way quantum computing 24[ and cryptography [lfl 
[251 - 4271 ] . They have been studied extensively theoretically, 
and been realized experimentally recently [HI, [29j] . 

Given a graph G = (V, E) defined by the set V of n 
vertices, and set E of edges, we denote by Af(j), the set 
of vertices with which vertex j is connected by an edge 
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(the neighborhood). Corresponding to each vertex j, one 
can associate a stabilizer operator: 
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where Zk and Xk, along with Yk, denote Pauli ma- 
trices acting on qubit k. We define the graph 
state basis by the 2™ common eigenstates \G X ) = 
> = ®j (%r IGooo-o), with ( Xj £ {0, 1}) of 
the n commuting operators gj, where gj\G XlX2 ... Xn ) — 
(— l) Xj \G XlX2 ... Xn ) . In particular, the canonical n-qubit 
graph state \G) = |Goo---o) is characterized by n indepen- 
dent perfect correlations of the form 



g 3 \G) = \G). 



(2) 



The set of all 2" products (hk) of the g^s forms the sta- 
bilizer group S. It follows from Eq. ([2]) that hj\G) = \G) 
for al l hj £ S. Graph states are robust against decoher- 
ence [30j, which enhances their practical value. 

An alternate equivalent definition of graph states, 
based on their generation via an Ising type of interac- 
tion, is as follows: 



\G) — ^-(j,k)eE^z ' k ^\ 



(3) 



where Cz is the controlled-phase gate. Here we use the 
usual notation Z\0) = |0),Z|1) = -\1),X\±) = ±|±). 

A special class of graph states are the linear cluster 
states, which correspond to a linear graph. An n-qubit 
cluster state is given by: 
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with Z n +i = 1. For example, 
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I'M = ^ (1+0+0) + 1+0-1) + 1-1-0) + 1-1+1)) , (5) 

where we use the notation |+0+0) = |+) |0) |+) |0), etc. 
It should be noted that different graphs may lead to the 
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same graph state modulo local transformations. For ex- 
ample, a star graph over n vertices leads to the same state 
irrespective of vertex it is rooted in. The principal graph 
transformation that leaves the entanglement property of 
a graph state invariant is local complementation [3l| . 

As highly entangled states, graph states show nonlo- 
cal correlations j3lM4ll | that contradict the assumption 
of local-realism, as demonstrated by their violation of 
Bell- type inequalities [42|, |43| . This is of cryptographic 
interest because there is a close connection between se- 
curity and the violation of a Bell-type inequality flil - licij . 
This connection assumes further importance in the de- 
vice independent (DI) scenario, where eavesdropper Eve 
is allowed to conceal additional dimensions in the devices 
of legitimate parties, that empower a side channel which 
leaks basis and output information to Eve. 

The remaining article is structured as follows. In Sec- 
tion m we introduce a twist to the QIS idea, which we 
term dual QIS, or DQIS, wherein a fixed fiducial state 
of an ancilla is teleported over an entangled state that 
encodes the secret and satisfies certain conditions of tele- 
portation. In Section [lll| we study the nonlocality of the 
DQIS code space, pointing out two ways of contracting 
Bell-type inequalities suitable to witness its nonlocality. 
In Section |lVl we discuss the security of the DQIS based 
on the violation of the Bell-type inequalities, in par- 
ticular, touching upon the device-independent scenario 
[47l HU . A simple single-qubit eavesdropping attack on 
DQIS based on a 5-qubit 1-bit error correcting code is 
given, to illustrate how Eve's entangling action can be 
detected because of monogamy of quantum nonlocal cor- 
relations. Finally, we conclude in Section fVl 



II. DUAL QUANTUM INFORMATION 
SPLITTING 

In standard QIS, one teleports an unknown state \*S/) 
(the secret) over a telcportation channel, which is a suit- 
ably entangled state. By contrast, in DQIS, we teleport 
a fiducial state, |0) by convention, across an entangled 
state Y&l) that encodes 1^), such that the end result of 
the teleportation is the recovery of \^>). 

DQIS can be useful in situations where the qudit se- 
cret \^>) is priorly known to the dealer Alice, before the 
distribution of the entangled particles to the agents, and 
furthermore it is unsafe for Alice to store Y$>) indefinitely 
in her station. This may be the case in situations where 
Alice has bounded quantum memory, and cannot stock 
secrets (in addition to her entangled particles) , but is able 
to prepare a fixed state when transmission is needed. Al- 
ice classically encrypts |^) using one of d 2 operations 
[lU , and transmits it to a distributor Dolly, who encodes 
it into an entangled state, which is transmitted to all 
relevant parties. 

For example, the classical encryption of a qubit re- 
quires the equi-probable application of the 4 four Pauli 
operations, which transforms a qubit in an arbitrary state 



into a maximally mixed state. Alice must divulge the 
two-bit (in general, 2 log d bits) decyrption information 
for recovery. Of course the dealer may also be the dis- 
tributor. 

The basic DQIS protocol works as follows: 

1. Alice prepares the N copies of the d-dimensional se- 
cret IvP) = X^jLi a j\j)i classically encrypts each of 
them, and transmits them to Dolly, the distributor. 

2. Dolly encodes each of them into an entangled state 
consisting of a superposition of suitable graph basis 
states. For example, state |^) is encoded as: 

d 

|*L>=£a j |G i >. (6) 
j'=i 

The |Gj)'s are chosen so that they are suitable for 
QIS and satisfy an additional, teleportation condi- 
tion discussed below. 

3. Dolly transmits the qubits in her possession to the 
legitimate parties Alice, Bob, Charlie, Rex, et al. 
After their receipt has been acknowledged over an 
authenticated classical channel, she randomly se- 
lects N — 1 of the transmitted states , and an- 
nounces their serial numbers. 

4. The parties perform their local operations chosen 
randomly from a pre- agreed set, and communicate 
their classical outputs to Alice. 

5. Alice performs a basis reconciliation where she de- 
termines if the measurements are appropriate to 
compute pre- agreed products (stabilizers hj) of lo- 
cal Pauli operations on the particles. If the mea- 
surements correspond to none of the pre-agreed 
hj's, they are discarded. Else, they are used to 
test the violation of a Bell-type inequality, which 
has the form: 

III: 

(B) = £>i><2g-m, (7) 

where B is the Bell operator and q (< m) is the 
largest number of the hj's that assume a positive 
value (+1) if each particle is assumed to possess a 
definite value of X, Y, Z irrespective of the measure- 
ment setting on any other particle. A contradiction 
with local-realism, and hence a demonstration of 
quantum nonlocality, occurs when q < m. 

The quantum bound on the l.h.s of Eq. ([7J is the 
algebraically allowed maximum of m. Alice deter- 
mines if the basis reconciled correlation data de- 
rived from the N — 1 states is compatible with dis- 
tillable secrecy (by checking if they produce a suf- 
ficiently high violation of a Bell inequality). 
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6. If the inequality (JT)) is found to be violated suffi- 
ciently highly, Alice teleports the fiducial state |0), 
and signals the other agents to proceed to the next 
step: they perform standard telcportation measure- 
ments on their particles on the unmeasured state, 
and convey the resulting classical information to 
the recoverer, Rex. 

7. Rex recovers the encrypted secret based on the clas- 
sical communication from all other parties. 

8. Alice gives Rex the classical decryption informa- 
tion, from which Rex recovers 

The type of encoding in Eq. © must be such that Rex 
recovers |$) even though Alice teleports |0). The con- 
ditions under which this works are discussed in the fol- 
lowing Section III Al It might be thought that since the 
secret is encoded in the distributed entanglement, and 
the teleported state is publicly known, therefore the tele- 
portation may be entirely eliminated. Still, the telcpor- 
tation is needed so that the distributed state can be ac- 
cessed via local operations and classical communication 
(LOCC) between the parties. 

The issue of conditions under which the parties are be 
able perform a test of Bell inequality violation on the 
encoded state, is discussed in Section IIIII From an ex- 
perimental perspective, implementing our protocol is not 
expected to be difficult in a set-up that realizes graph 
states, since the only additional requirement is creation 
of superposition of these states. 

A. DQIS conditions for a qudit 

We define a teleportation configuration C as an ar- 
rangement of agents and their actions that fixes who 
the secret dealer (Alice) is, who the recoverer (Rex) is, 
etc., and what their local operations are. Two such basis 
states, which we denote \Gq) and |Gi), constitute a tele- 
portationally divergent pair, if for a fiducial input state 
(taken here to be |0)), Rex recovers \j) (\j)) when the 
channel is Go (Gi), for a given C, and classical measure- 
ment outcome M of all other parties. 

More generally, consider a d-dimensional secret (a qu- 
dit state), and n-qubit graph basis states \Gj) (j = 



As the l.h.s of Eqs. (fT2")l are not mutually orthogonal, 
clearly there is no J7q M such that the recovery condi- 
tion ([9]) is satisfied. It follows that if Alice teleports the 
state |0) across the channel given by in Eq- @ with 



1, ■ ■ • ,d where d < 2 ra ) associated with a graph G(E, V). 
Letting: 

\^j)r = uA£(vk\0)u\Gj)ARt, (8) 

teleportation divergence entails that there exists a recov- 
ery operation Uq. m such that: 

|^-> = tfc,M|j>. (9) 

Here the labels u, A, R and £ denote the ancilla, Alice, 
Rex and the remaining agents; \vk) is a particular mea- 
surement outcome collectively obtained by all but Rex. 
The set of graph states that satisfy ([8} and ([9]) for all \vk) 
allowed under C are said to be teleportation divergent. 

Eq. © can be regarded as defining the map 7c, m, for 
a given measurement configuration and conditioned on 
measurement outcomes M. We have by virtue of quan- 
tum mechanical linearity, Eqs. (JSJ) and 

7c,m = U CM \T aj \j)j . (10) 

Thus, conditioned on the classical information M, Rex 
recovers the secret |\&). 

In the following two subsections, we illustrate DQIS 
of a qubit secret with a 4-qubit cluster state subspace, 
and the code space of a 5-qubit quantum error correcting 
(QEC) code. To conclude this subsection, we consider a 
simple example where DQIS fails for a particular choice 
of \Gj) and C. These are taken to be graph basis states 
given by the GHZ class states 

|Gooo) = -J=(|000) + |111)), 

|Gioo) = 4|(|000) - |111)), (11) 

We choose the configuration where Alice holds qubit 1 
and measures the ancillary qubit and her entangled qubit 
in the Bell basis, Bob holds qubit 2 and measures in the 
X basis, and Charlie must recover the secret. One finds: 



(12) 

I 

the code words given by Eq. (jlip . then under this config- 
uration the state recovered is not the secret but simply 
|0>. 



a\0) c +P\l)c oc ua(<S> + \b(+\H0)u + /3\1)u)\Gooo)abc, 
a\0) c -P\l)c oc ua(^ + \b(+\H0)u + P\1)u)\G 100 )abc- 
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B. Example: DQIS with cluster state space 

Letting d = 2 in Eq. (|6]), we choose \Gq) to be |0oooo) = 
\<f>l) in Eq. ©, and \d) = |0 O ioi) = Z 2 Z 4 \(j) 0000 ), with 
fiducial input state being |0). Alice holds the input |0) 
and qubit 1, Bob qubits 2 and 3, and Rex qubit 4. The 
secret \^) = a\0) + f3\l) is encoded as: 

= o#oooo) + W0101), (13) 

where \a\ 2 + \(3\ 2 = 1. Alice measures in the Bell basis 
{|$±) = -J. (|00) ± |11)), = -45(101) ± |10))}, while 



Bob in the computational basis {|00), |01), |10), |11)}, 
and Rex in the X basis. It may be verified that these 
\Gj)'s satisfy the divergence conditions for the above con- 
figuration C. Alice's outcomes are tabulated in Table U 
and Bob's outcomes corresponding to Alice's outcome 
j$+) in Table HU Based on Alice's 1 bit and and Bob's 
2 bit classical communication about their outcomes, Rex 
reconstructs |^>). 



Alice's measurement 


State obtained 


|$±) 
|*±> 


(a + /3)(|0 + 0) + lI- 
Ca +/3)(|0+0) - |1 - 


hl))- 

-0»- 


h(o-/8)(|0- 
h(a-/3)(|0- 


1> + |1- 
1>-|1- 


-o)) 



TABLE I: 4-qubit cluster state DQIS: Alice's measurement and the (unnormalized) state obtained by Bob and Rex. Ket |0 + 0) 
represents the 3-qubit state |0)|+)|0), and so on. 



Bob's measurement 


State obtained 


|00) 


a\+}+/3\-) 


101) 


a\-)+p\+) 


[io> 


<*\+)-P\-) 


111) 


0\+)-a\-) 



TABLE II: 4-qubit cluster state DQIS (type 1): 
surement and state obtained by Rex. 



Bob's mea- 



C. Example: DQIS with a QEC code space 

Quantum error correcting (QEC) codes [4!|[5(| are n- 
qubit graph states up to local transformations. A QEC 
code word is stabilized by n — k independent stabilizer 
operators, where k is the code rate. 

Let | Go) and \Gi) be respectively, the 5-qubit 1-bit 
error correcting code words introduced by Bennett et al. 



\0 L ) = -(-|00000) - |11000) - |01100) - |00110) - |00011) - |10001) + |10010) + |10100) + |01001) 

+ |01010) + |00101) + |11110) + |11101) + [11011) + |10111) + |01111)) 
|1 L ) = XXXXX\G ), (14) 

I 



where XXXXX signifies an application of X on each 
qubit. We let Alice have qubit 1, Bob qubits 2 and 3, 
Charlie qubit 4, while recoverer Rex have qubit 5. We 
let |G ) = \O l ) and \G X ) = \l L )in Eq. @. Alice tele- 
ports state |0) by measuring in the Bell basis an ancillary 
qubit prepared in that state, and her part of the entan- 
glement in Eq. ©. Bob and Charlie measure in 
the computational basis. It may be verified that this 



choice satisfies the teleportation divergence condition for 
the choice of C. Alice's, Bob's, Charlie's and recoverer 
Rex's measurement data are tabulated below in Tables 
IIIII and lTVl Rex recovers the secret based on Alice's 1 bit , 
Bob's 2 bit and Charlie's 1 bit classical communication. 
Charlie measures his qubit in the computational basis 
{|0),|1)} while Rex applies the nescessary operation to 
obtain the qubit. 



III. NONLOCAL SUBSPACES with respect to a Hermitian operator P, if 

P\Gj) = e\Gj)Vj G V, (15) 

We call two or more rt-qubit elements \Gj) of a subset 
V of the graph state basis as degenerate graph states 
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Alice's measurement 


State obtained 


|$±> 


a(-|0000> - |1100> - 0110) - |0011) + |1001> + 1010) + |0101> + 1 1111>) 
+/3(-|0111) - |1110> + |1101) + |1011) + |0001> + 0010) + 0100) + |1000>) 


|*±> 


a(-|1000> - |0001) + 0010) + |0100) + |1110) + |1101) + |1011) + |0111>) 
+/3(|0110) - |1111) - 0011) - |1001) - |1100) + 0101) + 1010) + |0000» 



TABLE III: Alice's measurement and state obtained by Bob, Charlie and Rex in case of teleportation using the Bennett et al. 
5-qubit code (fl4|) . 



Bob's measurement 


State obtained 


|00) 


a(-|00>-|ll»+/3(|01> + |10» 


|H) 


a(-|00) + |ll»+/9(|01>-|10)) 


|01) 


a(|01)-|10))+/3(|00)-|ll)) 


|10> 


a(|01> + |10»+/9(|00> + |ll» 



TABLE IV: Bob's measurement and state obtained by rest 



where e is a real number. If P is the Bell operator B in 
Eq. (J7J, then the states in V are called Bcll-dcgcncratc, 
and the space spanned by the operators in T> as Bell- 
degenerate graph subspace. 

The set of all local-realist (LR) models for a given 
number of settings of Alice, Bob et al. is a polytopc 
in a space of correlations. Eq uations of the kind (0 cor- 
respond to its facets [HI, [53[. Greenberger, Home and 
Zeilinger (GHZ) first showed how entangled states with 
perfect correlation lead to a dramatic contradiction with 
LR models [HH • Mermin [4l[ pointed out how these per- 
fect correlations can be used to construct a Bell-type in- 
equality of the form Eq. The problem of deriving 
Bcll-typc inequalities for various kinds of graph states 
has been explored by different authors in a number of 
directions [IlHIlj]. 

We denote by the DQIS code basis C, the set of graph 
basis elements \Gj) in Eq. ©. Our aim is to construct a 
Bell operator with respect to which all and only elements 
of C are degenerate. Furthermore, they should each vi- 
olate the corresponding Bell inequality to its algebraic 
maximum of to, thereby making C maximally nonlocal. 
This Bell operator will thus serve as a witness for the 
nonlocality of the encoded state. We present two com- 
plementary approaches to this problem, discussed in the 
following two subsections. 



A. Bell-degeneracy through unresolvability of 
generators 

Suppose that all n generators gj of a given n-qubit 
graph basis are involved in the to operators hk's that 
appear in the Bell inequality (|7|) . At most n of them can 
be independent. If fewer than n are independent, this 
gives rise to other graph basis state(s) \G') than \G) that 
are consistent with (B) = to, and thus serves as a basis 
for degeneracy. 



Theorem 1 Given an n-qubit graph state \G) that max- 
imally violates a Bell inequality Eq. where B is a 
non-trivial functional of all n gj 's, if the number of inde- 
pendent operators hj in B is r (< n), then the dimension 
of the Bell-degenerate subspace containing \G) is 2 n ~ r . 

Proof. The maximal violation of the Bell inequality ([7]) 
by \G) implies that this state satisfies the m constraints 
yjLihj ~ * +!• If r = n, then one can solve for the gj's 
to obtain a unique solution, which must be V" =1 .9j = +1, 
corresponding to \G). If r < n, then there are fewer con- 
straints than variables (n). Since the gj are two- valued 
(±1), this corresponds to 2 n ~ r possible ^-assignments 
consistent with the to constraints. I 



If fewer than n generators appear in B, then there will 
be additional degeneracy, by virtue of Theorem [2] below. 
Let S denote the set of Bell-degenerate graph basis states. 
If the code rate of a DQIS protocol is k bits, we must 
choose 2 k elements from S that satisfy the conditions 
© and ©. A necessary condition for this is, clearly, 
r + k < n. 

An example: The linear cluster state |</>oooo) m Eq. ([5]) 
is a graph state corresponding to the stabilizing operators 
.91 = XZII -> +1, g 2 = ZXZI -> +1, .93 = IZXZ -> 
+1 and .94 = II ZX +1. The Bell operator 

Bf = h^hi + hs + h^ 

= .91.93 + 52.93 + .9153.94 + 52ff3#4 

= XIX Z + XIYY + ZYYZ - ZYXY, (16) 

for which 9 = 3 (at most only 3 terms in Eq. (|16|) can 
be simultaneously made positive when assigned determi- 
nate values ±1 non-contextually), so that the local- realist 
bound is 2. It attains the algebraically maximum value 
of to = 4 when applied to |<^oooo) The product of 

any three of the four summands in Eq. (fTS)) is equal 
to the remaining one, implying that the 4 constraints 
Vjhj — > +1 imposed by these operators are not indepen- 
dent; only 3 are. By Theorem [T] this corresponds to a 
Bell-degenerate subspace of dimension 2. Solving for the 
gj's we find 34 = = ^3^4 — > +1. The remaining 

three generators cannot be resolved, but are subject to 
the condition gig 2 = — > +1, .92.93 = ^1/12^3 — > +E 
which is consistent with g\ = 92 = .93 = — 1, apart from 
of course g\ = gi = .93 = +1. Thus, we find that S 
additionally contains the state with the graph signature 
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(—1,-1,— 1,1), which corresponds to the state 



1 0mo) — ZiZ 2 Z 3 \(j>Qooo} 

= i (|-o-o> + 1- 



■0+1) 



-1+0) 



1+1-1)), 

(17) 



which also yields (B) = 4. A teleportation configuration 
under which these two elements of S are teleportation- 
divergent is thus suitable for secure DQIS. 

Suppose / stabilizer generators fj appear in all the 
hj's in Eq. ([7]). If \G) is a state that maximally vio- 
lates Eq. 0, then the I — 1 constraints imposed by the 



r s~i 

J—0:j even 3 



ll-l 



above requirement correspond to 

states obtained by flipping the sign of an even number 
of these generators, since they preserve the value assign- 
ment /1/2 • • • fi — > +1, and hence the value assignments 
hj +1 on these states. For the Bell operator 



B% = 



5254(1 + 3i)(l + .93) 
ZXIX + YYIX + YXXY 



ZYXY, (18) 



which also has the local-realist bound of 2, and the same 



quantum bound of 4 on the state |0oooo) 31 1 . Only three 
of the four summands in the rhs of Eq. (|16[) are inde- 
pendent, so that by Theorem [TJ the dimension of the 
Bell-degenerate subspace 2, which is immediately seen to 
correspond to the state obtained by flipping the sign of 
both g 2 and g^: i.e., the state with the graph signature 
(1,-1,1,-1), which corresponds to the 4-qubit cluster 
state |0oioi) °f Section ITTBl 



B. Bell-degeneracy via a stabilized subspace 

The other method is applicable to (n, k) graph codes, 
the subspace of a n-qubit states, stabilized by n — k sta- 
bilizer generators gj, with k > 0. We denote by V the 
set of these generators. Let us denote by S\-p, the re- 
striction of S to products of elements in V . Up to local 
transformations, QEC codes are graph codes. 



Theorem 2 Given a (n, k) graph code Q stabilized by 
operators gj (1 < j < n — k ), any Bell operator Bp of 
the type {^), obtained by adding only elements hj € S\-p 
induces a Bell-degenerate subspace of dimension >2 k . If 
n — k of these hj 's are independent, then the dimension 
is exactly 2 k . 

Proof. For each of the 2 k graph basis state |G") sta- 
bilized by <?j's in V, clearly hj — > +1 for summands in 
B-p, implying that the Bell inequality is maximally vio- 
lated for any state in the subspace spanned by these basis 
states. If the number of independent stabilizers in B-p is 
r < n—k, then by virtue of Theorem [1] the dimension of 
the degenerate subspace is 2 k x 2("~ fc )~ r = 2"~ r . Setting 
r = n — k in the last expression above, we obtain 2 k , as 
desired. I 



QECC code states are graph states, that satisfy the 
graph conditions @ up to local transformations. A set 
of four stabilizer operators (which need not have the error 
correcting property for our purpose) for the above 5-qubit 
code (1141) are: 



9i 

.92 

93 
94 



XYYXI 
IXYYX 
ZYIYZ 
XYZYX. 



(19) 



from which we can construct the following stabilizers, 
which we cast in the form of a GHZ contradiction with 
local realism: 

hi = gig 3 g4 = ZYXXY ^ +1 

h 2 = .91.94 = -IIXZX — > -1 

h 3 = g 2 g 3 = ZZYIY — S- +1 

hi = .91.92 = XZIZX — > +1 

h 5 = ,9i = XYYXI — ► +1. (20) 

This constitutes a GHZ contradiction [54| with any local- 
realist assignment of definite values to X, Y, Z as can be 
as follows: in the operators hj, a Pauli operator always 
appears twice along a vertical column, implying that the 
product of the hj's should be 1. Yet the product of the 
above value assignments to the state \G) is —1. This logi- 
cal contradiction means that the X, Y, Z's of the particles 
cannot be thought of as possessing determinate values 
independent of the measurement context (the choice of 
settings on the other particles). 

From Eq. (|20p one can write down the Bell operator 



^5g = hi + h 2 + h 3 + hi + h 5 , 

= 9i94(93 + 1) + 92(93 + .9i) + 9i ■ 

Eq. (|21b[) satisfies the Bell inequality 

(B 5q ) < 3, 



(21a) 
(21b) 



(22) 



as can be seen by evaluating B$ q for all possible 2 5 value 
assignments ±1 to X, Y, Z's in Eq. (|21aj) . By virtue of 
Theorem [H both the states |0l) and \1 L ) of flU) as well 
as any superposition thereof, violate the above inequality 
maximally, by the value 5. There is no further degener- 
acy, since four of the hj's in Eq. (|2"0"|) are independent. 
Solving for the gj's we obtain: g\ = hs; gi = hih^;g 3 = 
/13/14/1.5 and gi = h 2 h^. 

Here are two examples where both the above two the- 
orems must be invoked. The stabiliziers for the Stcane 
[50[ code are g x = XiX 5 X 6 X 7 ,g 2 = X 2 X 3 X 6 X 7 ,g 3 = 
XiX 3 X 5 X 7 , gi = ^4^5^6^7, 95 = Z 2 Z 3 Z 6 Z 7 and g 6 = 
Z\Z 3 Z^Zi, with a Bell inequality taking the form 

(#Steane) = (hi + h 2 + h 3 + h A + h 5 + h 6 ) 

= (9192(94 + .94.95 + 1) + .93.95(.92 + .9l) + .95) 

< 4, (23) 
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where hi = 515254, h 2 = .91525455, h 3 = gig 2 , and so 
on sequentially. The quantum mechanical case yields the 
maximal (B) = 6 (the number of hj's in Eq. ([23]) ) for 
any state a|0i) + in the code space of the Steane 

code. In this case V = {51,52,53754,55} implying that 
all 2 7 ~ 5 = 4 7-qubit basis states stabilized by these 5 
operators span a Bell-degenerate subspace. 

In addition, only 4 of the hj's are independent in Eq. 
(f23|) . in that the following two constraints hih 2 = h§ 
and /14/15 = h 3 appear. Thus for any value assignment 
of 56 and 57, there arc 2 5-4 = 2 graph basis states that 
maximally violate Eq. (|23|) . which are determined by 
solving for the 5 gj's in terms of the 6 operators hj's. 
Solving, we find 54 = h 2 h 3 h^ —> +1 and 55 = h§ —t +1, 
while 5152 = hi -> +1, 5153 = h 3 h 5 -> +1 and 5253 = 
h<ih§ — ^ +1. This corresponds to the graph signatures 
(1,1,1,1,1) and (—1,-1,-1,1,1) in the first five 5/s. 
Thus in all there is Bell-degeneracy of 4 x 2 = 8. 

The stabiliziers for the Shor code [55[ are 51 = 
ZZIIIIIII,g 2 = IZZIIIIII,g 3 = IIIZZIIII,g 4 = 
IIIIZZIII,g 5 = IIIIIIZZI,g 6 = IIIIIIIZZ,g 7 = 
XXXXXXIII, 58 = IIIXXXXXX for which a Bell 
inequality takes the form 

(£ S hor) = (hi + h 2 + h 3 + h 4 + h 5 + he + h r ) 

= (.9358(5154 + 5557 + 52 + 57) + 5s (5455 + 1) 
+ 5152) < 5, (24) 

where hi = 535s5i54, h 2 = 5 3 5s5557, h 3 = 535852, 
and so on, sequentially, while the quantum mechani- 
cal state yields (B) = 7 for any state a|0i) + 
in the code space of the Shor code. In this case V = 
{91, 52, 53, 54, 55, 57, 5s} implying that all four 9-qubit ba- 
sis states stabilized by these 7 operators span a Bell- 
degenerate subspace. 

In addition, only 6 of the 7 hj 's arc independent in Eq. 
(f2"3")> . giving rise to 2 degenerate sets in V . Thus for any of 
four value assignments to g§ , 59 , there are two graph basis 
states that maximally violate Eq. (f2~4")l , which are deter- 
mined by solving for the 7 gj's in V in terms of the hj's. 
This yields 54 = hih 3 h 7 — > +1, 55 = hih^h^h^hr — > +1 
and 5s = he -> +1, while 5153 = hih 2 h 4 h^ -> +1, 5253 = 
/13/17 -> +1, 5i52 = ^6 +1 and 5357 = h 4 h 7 -t +1. 
This corresponds to the graph signatures (1,1,1,1,1,1,1) 
and (-l,-l,-l,+l,+l,-l,+l)forthe 5/sinP. Thus, 
in all, we obtain Bell-degeneracy of 4 x 2 = 8. 



IV. SECURITY CONSIDERATION: TOWARDS 
A DEVICE-INDEPENDENT SCENARIO 

Although the security of quantum key distribution 
(QKD), has been known for some time, recent work has 
uncovered the close connection between security (that le- 
gitimate participants can distil secret bits) and the viola- 
tion of a Bell inequality, both in the two-party as well as 
multi-party [IH l4q | scenarios, an intuition that already 
exists in the Ekert protocol [44| . 



This connection has assumed further importance for 
other reasons: a proof of security based on the viola- 
tion of Bell type inequality is expected to hold good in 
any nonlocal, non-signaling theory (47j . and even in a 
device independent scenario [4q |. i.e., one where there is 
a lack of complete characterization of devices used. The 
eavesdropper may be the vendor from whom Alice and 
Bob purchase their (entangled) states and devices. Eve 
may insert hidden dimensions into the devices, and un- 
known correlations into the states, that would empower 
side channels that leak to her information about Alice's 
and Bob's measurement choices and outcomes. 

Thus a conventional check of error rates will not do. 
The legimate parties must verify that the correlation data 
has not been produced by a separable state in a larger 
dimensional space [56| . However, if the legitimate par- 
ties verify via simultaneous local operations and classi- 
cal communication that a Bell inequality is violated to 
a sufficiently high level, then, assuming no-signaling, the 
correlations are guaranteed to allow distillable secrecy 
[57l |58| . This is a consequence of the monogamy [59| of 
quantum correlations and holds good in nonlocal, non- 
signaling theories [poj . though no-signaling is not neces- 
sary [611 ] . 

Let us consider the 4-qubit cluster state DQIS con- 
sidered in Section III Bl applied to the protocol described 
earlier in Section ITT] Alice holds qubit 1, Bob 2 and 3, 
and, finally, Rex qubit 4 of iV copies of the encoded ver- 
sion of the state |^) or one of its encrypted versions. Al- 
ice randomly announces the serial number of one of these 
copies. On each of the remaining A — 1 copies, Alice ran- 
domly makes a measurement drawn from the set Sa = 
{Y, Z}, Bob from the set S B = {XI, YI, XX, YX}, and 
Rex from Sr = {X, Y}. They classically communi- 
cate their measurements and outcomes to Alice. About 
4/ (2x4x2) = 1/4 of these are found to have mea- 
sured one of the four 4-qubit observables appearing as a 
summand in B\ in Eq. (|18[) . and the parties verify that 
the outcomes are consistent with the sufficiently high vi- 
olation of the Bell inequality {Bp} < 2. Importantly, 
by prior synchronization of clocks, each participant must 
measure her or his observable simultaneously, in order 
to avoid the possibility of a signaling from the source to 
the measurement appartuses [62(. Bounding the timing 
of the classical communication is used to ensure this. 

Conditioned on their passing the Bell test, they pro- 
ceed to implement the DQIS protocol to allow Rex to 
reconstruct the state \^). If not, then they may either 
abort the run of the protocol, and restart from a fresh 
distribution of entangled states. 

As an illustration of the role of monogamy, we consider 
below a simple single-qubit attack by Eve on a DQIS 
protocol based on the 5-qubit state (fT4"]) , which produces 
a lowering of the violation of the Bell inequality observed 
by Alice, Bob, and Rex. This is because an attempt 
by Eve to extract information entangles her system with 
theirs, causing the latter to diffuse from the code space 
span{|Go), It is important that the degeneracy is 
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restricted to the code space, since otherwise diffusion of 
the state to degenerate non-coding sectors would not be 
detected by looking for a reduction in the Bell inequality 
violation. 

In the device independent scenario, Eve's hidden di- 
mensions will become entangled with the the legitimate 
particles, thereby producing a detectable dip in the ob- 
served maximal violation of the Bell inequality ([21?]) . 
Thus sufficiently high violation of this inequality guaran- 
tees that the entangled state lies within the code space, 
and is uncorrelated with unknown degrees of freedom. 

Suppose Eve attacks the fourth qubit of an encoded 



state in the span of the codewords (fl4)) . via a 1-qubit 
attack given by the interaction: 

U(6)= 1 -±^®I + 1 -^®( C0S l Shl * V (25) 
2 2 \ sin 6 — cos I 

which continuously varies from an identity operation to 
CNOT as 9 ranges in [0, tt/2]. 

Applying U on the encoded state and her ancilla pre- 
pared in the state |0), Eve transforms an arbitrary logical 
state as: 



(a|Oi}+0|li»|O) — > \V)abcde 

= ^=(H0 i ;0)+^|l L ;0)]|0) J3 + H0 i ;l)+/3|l i ;l)](C|0)+5|l))), (26) 

I 

where | ; k) denotes the superposition of terms in the respectively. The reduced density operator for state with 
above 5-qubit code word encoding bit j having bit k in the legitimate agents is given by: 
the fourth position; C and S denote cos(#) and sin(6 l ), 



Pabcd = \ (([a|0i;0) + P\1 L ;0)] + C [a\0 L ; 1) + /3|1 L ; 1)]) ([a(0 L ;0| + /3(U;0|] + C [a(0 L ; 1| + 0(1 L ; 1|]) 

+ ^ 2 (a|0 L ;l)+/3|l L ;l))( a (0 i ;l|+/3(l i ;l|)), (27) 



which has support in the 4-dimcnsion Hilbert space 
spanned by {|0 L ; 0), |0 L ; 1), \1 L ; 0), \1 L ; 1)}. 

Since h m \ji) = it follows that either h m \jL',k) 

equals \jz',k) or \ji,;k). In particular, from Eq. (|T9|) . 
it follows that the action of the hm's is to leave \j;k) 
invariant or to toggle it in the second index (when there 
is a X or Y in the 4th index). Thus: 

One then finds that 



Tr B (h m pABCD) = 



Tr_E (pabcde) = ±1 (m = 2, 3, 4) 
— cos(6*) (m = 1, 5), 

(29) 



from which it follows that 

(B 5q ) =3 + 2cos(0), 



(30) 



implying that the attack can be witnessed by a reduc- 
tion in the degree of violation of the Bell inequality (|2"21 , 
dropping all the way down the local-realistic bound of 3 



when the attack is maximal with 6 = n/2. It should be 
noted in the general case, the tolerable Bell inequality 
violation will be well above the local-realist bound. 



V. CONCLUSIONS 

The protocol of DQIS, which inverts the role of the in- 
put state and channel, will be useful in situations where 
the dealer has bounded quantum memory, and cannot 
stock secrets but is able simply prepare a fixed state 
when transmission is needed. Classical encryption can 
be used to protect the encoded state if required. The 
coding graph states must possess suitable teleportation 
divergence properties for DQIS to work, and must be Bell 
degenerate for proving security via a Bell test on the en- 
coded state. We studied two methods of producing Bell 
degeneracy. A simple example of DQIS with a 5-qubit 
QECC was presented. The use of the nonlocal proper- 
ties of the code states is a useful way to perform security 
check, and particularly indispensible in the device inde- 
pendent scenario. Further, a proof of security is expected 
to hold good in any non-signaling, nonlocal theory, which 
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is useful in the unlikely event that quantum mechanics turns out to be invalid. 
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